How the scam operates.
This domain is constructed using punycode encoding, a technique that allows non-ASCII characters to appear in web addresses. The resulting URL renders visually near-identical to a well-known Ethereum wallet service in most browsers, particularly when links are shared via messaging platforms or displayed in low-resolution contexts. The target audience is Ethereum users seeking to access a familiar wallet interface, typically via search engines or shared links rather than direct navigation.
The operational pattern observed across impersonation sites of this type involves presenting a convincing replica of the target interface. Victims who reach the site are prompted to enter recovery phrases, private keys, or connect an existing wallet. These interactions do not perform the stated function. Instead, submitted credentials are captured by the operator and used to drain connected or associated wallets. The user receives no error, or is redirected to the legitimate service after submission, giving the false impression that the interaction was routine.
The theft typically becomes apparent when the victim next accesses their genuine wallet account and finds balances depleted or assets transferred to unknown addresses. At this point, the transaction is irreversible. Recovery efforts are complicated by the pseudonymous nature of blockchain transactions and the absence of any identifiable operator behind the impersonation domain.
Red flags we documented.
- 01Wallet connection requested via an unfamiliar domainThe user is asked to connect their wallet to an airdrop site, swap interface, or NFT minting page on a domain that mimics a legitimate project. Once connected, a malicious signature transfers approval to drain assets, often without an obvious prompt.
- 02Urgency framing, "claim within 24 hours"Time pressure is engineered to prevent the user from verifying the URL against the project's official channels. Legitimate airdrops and minting events have multi-day claim windows.
- 03Asks for seed phrase / private keyNo legitimate service ever needs your 12/24-word recovery phrase or private key. Any prompt for these is an active drain attempt, regardless of how legitimate the surrounding page appears.
What you can do now.
Open a free 24-hour case assessment with CryptoLeek +
Tell us what happened. A senior analyst reads your file within 24 hours and replies with an honest yes/no/conditional on recovery. The assessment is free. If we cannot recover the funds we say so plainly, including which (free) regulator channel you should use instead. If we accept the case, we open a numbered case file and issue a written quote for a flat investigation retainer before any work begins, scoped to case complexity, the jurisdictions involved, and the on-chain trail.
Trace your funds on-chain with our analysts +
We trace stolen crypto across BTC, ETH, EVM L2s, Solana, Tron, and major stablecoins using the same toolchain as regulators and tier-1 exchange compliance teams. The output is a forensic report anchored to specific transaction hashes and block heights, the evidence that exchanges, payment processors, and counsel actually act on. Recovery starts here.
Recover with counsel where civil action makes sense +
Where the trace lands in a jurisdiction with cooperative banks and courts, we coordinate with bar-licensed counsel in our 40+ jurisdiction network for civil action and asset-freezing orders (Mareva-style). Counsel bill you directly; the CryptoLeek investigation retainer is independent of counsel fees. The outcome is funds released back to your nominated wallet or bank account.